Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- e####.####.com
- s####.####.in
Запросы HTTP GET:
- s####.####.in/stats/s?o=####&nv=####&p=####
- e####.####.com/api/v1/start?a=####&ab=####&av=####&br=####&c=####&de=###...
- e####.####.com/api/v1/resolve?a=####&i=####&k=####&u=####&p=####&pi=####...
- e####.####.com/api/v1/canonical?a=####&br=####&c=####&de=####&ma=####&mo...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C2634024E-0001-0837-24B70B6D5784SessionApp.cls_temp
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/crash_marker
- <Package Folder>/app_app_apk/gold.dat.jar
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes705708267.zip
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264C004C-0002-0891-24B70B6D5784SessionOS.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C263502AC-0002-0837-24B70B6D5784SessionOS.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C2634024E-0001-0837-24B70B6D5784BeginSession.cls_temp
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/shared_prefs/Cocos2dxPrefsFile.xml
- <Package Folder>/shared_prefs/branch_referral_shared_pref.xml.bak
- <Package Folder>/shared_prefs/branch_referral_shared_pref.xml
- <Package Folder>/files/checkFile.txt
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264C004C-0002-0891-24B70B6D5784BeginSession.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C263502AC-0002-0837-24B70B6D5784SessionUser.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C263502AC-0002-0837-24B70B6D5784SessionDevice.cls_temp
- <Package Folder>/shared_prefs/BNC_Server_Request_Queue.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap.tmp
- <Package Folder>/files/file
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264A018D-0001-0891-24B70B6D5784SessionCrash.cls_temp
- <Package Folder>/files/AdjustIoActivityState
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C2634024E-0001-0837-24B70B6D5784SessionOS.cls
- <Package Folder>/databases/Apsalar.sqlite_a0d3e42c26f9f0e8c4019e9056b849560351f47a-journal
- <Package Folder>/shared_prefs/ApsalarAppPrefs.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C2634024E-0001-0837-24B70B6D5784SessionDevice.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C2634024E-0001-0837-24B70B6D5784.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_f150f761-0e3b-42af-84da-7421fb96f426_1495017013659.tap
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264A018D-0001-0891-24B70B6D5784SessionApp.cls_temp
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264A018D-0001-0891-24B70B6D5784SessionDevice.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264A018D-0001-0891-24B70B6D5784BeginSession.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_5ef985ab-b407-4fa6-94d5-01d99db35434_1495017012803.tap
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C2634024E-0001-0837-24B70B6D5784SessionUser.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264A018D-0001-0891-24B70B6D5784.cls_temp
- <Package Folder>/files/AdjustIoPackageQueue
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264A018D-0001-0891-24B70B6D5784SessionUser.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264C004C-0002-0891-24B70B6D5784SessionApp.cls_temp
- <Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264A018D-0001-0891-24B70B6D5784SessionOS.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C264C004C-0002-0891-24B70B6D5784SessionDevice.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C2634024E-0001-0837-24B70B6D5784SessionCrash.cls_temp
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C263502AC-0002-0837-24B70B6D5784SessionApp.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C263502AC-0002-0837-24B70B6D5784BeginSession.cls_temp
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.Onboarding.xml
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
